Overview

overview

9

Static

static

3

Bootstrapper.exe

windows10-2004-x64

5

Bootstrapper.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    150s
  • max time network
    142s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260629-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    05/07/2026, 02:06

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Bootstrapper.exe
  • Size 29.9MB
  • Sample260705-cjx4tact2n
  • SHA256 7864984725be67523dd5913907f24dee7149a1bc9b346c826a4c0d4047f78561
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasion

Malware Config

Signatures

  • Enumerates VirtualBox registry keys 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
    defense_evasion
  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
    defense_evasion
  • Executes dropped EXE 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 1 IoCs

    Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
    "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
    1⤵
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:6008
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c cls
      2⤵
        PID:472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c cls
        2⤵
          PID:5772
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c cls
          2⤵
            PID:1224
          • C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
            "C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe"
            2⤵
            • Enumerates VirtualBox registry keys
            • Looks for VirtualBox Guest Additions in registry
            • Looks for VMWare Tools registry key
            • Executes dropped EXE
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Checks for VirtualBox DLLs, possible anti-VM trick
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of WriteProcessMemory
            PID:3812
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c cls
              3⤵
                PID:7164
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c cls
                3⤵
                  PID:6408

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  BootstrapperNew.exe
                  • Path C:\Users\Admin\AppData\Local\Temp\BootstrapperNew.exe
                  • Size 27.7MB
                  • SHA256 6ba1bcd5c7860675611386d92eb5604f7e4f775f2219b7a7cc7ed3029cbc450d
                  • MD5 SHA1 SHA512 SSDEEP TLSH
                  Submit Download

                  memory/3812-21-0x0000000140000000-0x0000000142CF4000-memory.dmp
                  Download

                  memory/3812-25-0x0000000140000000-0x0000000142CF4000-memory.dmp
                  Download

                  memory/6008-0-0x00000001400A7000-0x00000001412A8000-memory.dmp
                  Download

                  memory/6008-2-0x00007FFFF0B40000-0x00007FFFF0B42000-memory.dmp
                  Download

                  memory/6008-1-0x00007FFFF0B30000-0x00007FFFF0B32000-memory.dmp
                  Download

                  memory/6008-3-0x0000000140000000-0x0000000143088000-memory.dmp
                  Download

                  memory/6008-7-0x0000000140000000-0x0000000143088000-memory.dmp
                  Download

                  memory/6008-8-0x00000001400A7000-0x00000001412A8000-memory.dmp
                  Download

                  memory/6008-16-0x0000000140000000-0x0000000143088000-memory.dmp
                  Download

                  memory/6008-18-0x00000001400A7000-0x00000001412A8000-memory.dmp
                  Download